In order to provide the best service to users, ZEP Co., Ltd. (the "Company") uses personal data from users to provide some of its services.
Article 1 [Personal Data Collection and Collection Method]
1. The Company will collect and handle the following personal data, and the collected personal data will not be used for purposes other than those specified herein.
1) Membership registration and management
- Required: email address (member ID), age verification (14 years of age or older), nickname, profile photo
2) Data automatically created and collected while using services
- IP address, service usage history, browsing history, date and time of membership registration, abuse history, device information
2. The Company will collect personal data using the following methods:
- Data being directly input by the user on the Company’s website, applications, or within its services
- Data being collected through automatic collection devices
Article 2 [Purpose of Collection and Use of Personal Data]
1. The Company may use collected personal data for the following purposes. Personal data which is handled by the Company is not used for other purposes than the following, and in the case of changes to the purpose of use, necessary measures such as consent receipt will be taken according to relevant laws and regulations.
1) Official website membership registration and user management
- Confirmation on membership registration, self-identification/verification for provision of services, maintenance/management of membership qualifications, confirmation of valid membership registration records, management of abusers, revealing abusers and restricting their use, fulfillment of the contractual obligations, dispute resolution
2) Use of services
- Complaint handling and provision of other customer services, delivery of notices
3) Use required as per other applicable laws
- Performance of obligations stipulated in law, etc.
Article 3 [Retention Period of Personal Data and Withdrawal of Users]
1. The Company will retain and use the personal data collected from the user while the user's status is maintained. If the purpose for the collection of the data is completely achieved, the data will be deleted immediately regardless of whether or not the user’s status is maintained. However, the Company will keep and use personal data for the written retention period if the Company has any of the following bases for retention:
- Retention basis: consumer satisfaction, dispute settlement, restriction to re-registration of membership, etc., when cancelling membership
- Retention period: 30 days
- Retained items: email, access records, abuse records, nickname
2. Notwithstanding the provisions of Paragraph 1 above, if there is reason to hold personal data under relevant laws and regulations, the Company will preserve the data for a period of time prescribed in relevant laws and regulations including the Commercial Act and the Act on the Consumer Protection in Electronic Commerce, Etc. In this case, the Company will separate the data to be preserved, and the preservation periods are as follows:
1) Records concerning display and advertising: 6 months (Act on the Consumer Protection in Electronic Commerce, Etc.)
2) Record of contract or withdrawal of subscription: 5 years (Act on the Consumer Protection in Electronic Commerce, Etc.)
3) Record of payment and goods supply: 5 years (Act on the Consumer Protection in Electronic Commerce, Etc.)
4) Record of complaints or disputes of consumers: 3 years (Act on the Consumer Protection in Electronic Commerce, Etc.)
5) Books and supporting documents on all transactions as prescribed by tax law: 5 years (Framework Act on National Taxes)
6) Record on Electronic Financial Transactions: 5 years (Electronic Financial Transactions Act)
7) Record of access logs, connection IP information, etc. Service use: 3 months (Protection of Communications Secrets Act)
3. Your account will be withdrawn immediately upon application for withdrawal. User registration with the same email address will be restricted for one month after withdrawal.
Article 4 [Protection of Personal Data]
1) If the consent of the user has already been obtained
2) If there is an unavoidable situation in accordance with special provisions of the law or in order to comply with legal obligations (including cases of a request by an investigating agency or an administrative organ in accordance with the procedure and method prescribed by relevant laws and regulations for the purpose of investigation)
3) If a business assignment, merger, or etc. is to take place (However, if the user data needs to be transferred due to reasons related to the Company's assignment, etc., the Company will notify users of such fact in advance as per the procedure and method prescribed by applicable laws and provide members with the right to withdraw their consent to the transfer of personal data.)
2. Members have the right not to consent to the provision of personal data to third parties and may withdraw their consent to the provision of personal data to third parties. Even if they do not consent, services that are not based on provision of personal data to third parties will remain available, while the use or provision of services dependent on the provision of this data to third parties may be limited. Notification will be provided for any other changes to the provision of personal data to third parties through separate notifications.
Article 5 [Handling Consignment of Collected Personal Data]
1. The Company consigns personal data as described in Paragraph 2 in order to increase the quality of its services and to perform a certain part of tasks required to provide services and stipulates necessary matters for the personal data to be safely managed as per applicable laws and regulations upon conclusion of the consignment contract. Also, the amount of data to be shared is limited to the minimum amount necessary to achieve the concerned purposes.
2. The trustees and entrusted task are as below:
Amazon Web Service Inc.
Operation and maintenance of cloud servers located in South Korea storing personal information
Article 6 [Procedures and Methods for Destroying Personal Data]
1. In principle, when the purpose for collecting and using a user’s personal data is achieved, the Company will destroy the data without delay. The Company’s procedures and methods for personal data destruction are as follows:
1) The data entered by the user for the purpose of membership registration, etc., is transferred to a separate database (or, in the case of paper documents, a separate document box) after the purpose is accomplished as per the internal policy and other relevant laws and regulations; the data is then stored temporarily and then destroyed. Personal data will not be used except for as prescribed by laws.
2) Personal data printed on paper is destroyed by a shredder. Personal data stored in the form of electronic files is deleted using a technical method that prevents it from being restored.
2. The Company will, in accordance with Article 39-6 of the Personal Information Protection Act, in order to protect the personal data of those who have not used the service for a long period, immediately destroy the personal data of the user, or save or manage it separately, if the following conditions are met:
- Subject: Users who have not logged in for the past 1 year or have no history of inquiries or users who have no history of payment settlement for the past 1 year (In case of members registered for settlement)
- The Company notifies the user through email, etc. 1 month before the separation and storage of the personal data of the user who has not used the service for an extended period.
Article 7 [Rights and Obligations of Users and Legal Representatives]
1. Users and their legal representatives may view or modify their personal data at any time. This can be done through Settings-View and Change Member Information within the service or through a wired phone call with an agent. However, if the user's personal data is linked with an external platform, such as Google, the user must view or change the personal data according to the method provided by the concerned platform vendor.
2. If a user requests the correction of a personal data error, the Company will correct the error without delay or inform the user of the reason for not correcting it and will not use or share the data until necessary action is taken. However, the Company may provide such data when requested in accordance with applicable laws.
3. If the person whose data is to be collected is under 14 (a "Child"), the Company will obtain the consent of the legal representative separately from the Child's consent for the collection, use, provision, etc. of personal data protection.
4. In order to obtain the consent as described in Paragraph 1, the Company may request the minimum amount of data necessary, such as the name and address of the legal representative, and the collected personal data of the legal representative may not be used for purposes other than to confirm the consent of the legal representative and may not be shared with third parties. The agreement of the legal representative is used for a Child for the resolution of customer complaints when there is a dispute with the Company, for the withdrawal of subscriptions, settlement of payments, and the supply of goods.
5. The withdrawal of consent or the expiration of the validity of the legal representative’s consent will be executed in a non-renewable manner 30 days after the expiration date. However, if there is a legal need to preserve the data as defined in the Commercial Act or the Act on the Consumer Protection in Electronic Commerce, Etc., the Company will keep the personal data of the legal representative for the period set by applicable laws and regulations.
6. The legal representative of the Child may request the retrieval of the Child's personal data, corrections, or the withdrawal of consent to the collection, use and provision of personal data. If such a request is made, the Company will take necessary measures without delay.
Article 8 [Installation and Operation of Automatic Personal Data Collection Tools and Their Refusal]
1. The Company installs and operates tools that automatically collect personal data, such as cookies (access information files) that store and retrieve user data from time to time to provide personalized services. A cookie is a small text file sent to the user's device by the server used to run an application and stored in your device's storage. When the user uses the application, the server reads the contents of the cookies stored in the user's device to maintain the user's preferences.
- To analyze visits to and uses of the website and provide the user with personalized usage environments
3. The installation of cookies is optional. As a result, the user can allow all cookies in the device settings or options, require permission to be given each time a cookie is saved, or refuse to save all cookies. However, if the user refuses to store all cookies, the service may be restricted or unavailable.
Article 9 [Technical and Administrative Protection Measures for Personal Data]
1. The Company takes the following technical and administrative measures while handling users’ personal data in order to prevent it from being lost, stolen, leaked, altered, or damaged.
1) Password encryption
Users’ passwords are encrypted, stored, and managed. Therefore, even if a user forgets his or her password and confirming said password is impossible, a new password can be issued after a predetermined identification process.
2) Enhanced network security
(a) The Company takes various technical measures to prevent the leakage of users’ personal data due to atypical network access from hacking, computer viruses, etc., and is constantly monitoring the network connection.
(b) The Company uses a secure cryptographic communication method for communication between its server and database and makes every effort to secure all systems using all possible technical means.
3) Minimization and training of handling staff
(c) Personal data security is handled thoroughly during personnel changes and responsibilities for accidents are clearly defined after both entering and leaving the Company.
4) Access and storage control
The area where personal data is handled and stored is set as a secure zone so that only those who have the right to handle personal data can access it. Tangible and electronic records containing personal data are stored securely in areas that are equipped with security devices and require special permissions to access.
5) Operation of personal data protection team
Users are obligated to protect themselves and not to infringe on the data of others. Users should be careful that their personal data, such as their password, is not leaked, and also that the personal data or postings of other users are not negatively affected. The Company will not take any responsibility for any personal data issues that occur due to a user's carelessness or mistake.
Article 10 [Personal Data Protection Manager]
1. The Company makes its best effort to provide the best service while keeping personal data safe. The personal data protection manager is responsible for the protection of personal data in case of incidents as described above. However, despite technical remedies, the Company has no liability for any damage to data due to unexpected accidents caused by basic network dangers such as hacking, and any disputes over the posts made by visitors.
- Personal data protection manager
- Name: Youngeul Kim
- Email address: firstname.lastname@example.org
3. In some circumstances you are entitled to the erasure of your personal data without undue delay. Those circumstances include: (i) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (ii) you withdraw consent to consent-based processing; (iii) you object to the processing under certain rules of applicable data protection law; the processing is for direct marketing purposes; and (iv) the personal data have been unlawfully processed. However, there are exclusions of the right to erasure. The general exclusions include where processing is necessary: (a) for exercising the right of freedom of expression and information; (b) for compliance with a legal obligation; or (c) for the establishment, exercise or defense of legal claims.
You may request erasure of your information by contacting us at email@example.com
4. Please contact the following organizations if you need to report or consult about other personal data infringement.
[For South Korea]
- Personal Information Infringement Notification Center (http://www.1336.or.kr/ +82-2-1336)
- ePRIVACY (www.eprivacy.or.kr / +82-2- 580-0533~4)
- Supreme Prosecutor's Office, Advanced Crime Investigation Department (https://spo.go.kr/site/eng/main.do / +82-2-3480-2000)
- Cyber Terrorism Response Center (https://police.go.kr/eng/main.do/ +82-2-392-0330)
[For other countries]
Article 11 [Opinion Collection and Complaint Processing]
The Company has opened a window for filing opinions and complaints regarding the protection of personal data. Users who are dissatisfied with the handling of personal data may inquire about such issues to the person in charge of the personal data management of the Company and then will be notified of the result of their inquiries.
- Personal data manager email address: firstname.lastname@example.org
Article 12 [Notification Obligation]
This policy will take effect on November 30, 2021.